CVE-2025-1097

Name of the Vulnerable Software and Affected Versions ingress-nginx versions prior to 1.11.5 ingress-nginx versions 1.12.0-beta.0 through 1.12.0

Description A security issue exists where the auth-tls-match-cn Ingress annotation can be used to inject configuration into nginx. This may allow a remote attacker to execute arbitrary code within the context of the ingress-nginx controller and disclose Secrets accessible to the controller. In default installations, the controller typically has access to all Secrets cluster-wide.

Recommendations Update to version 1.11.5 or later. Update to version 1.12.1 or later. As a temporary workaround, restrict or avoid using the auth-tls-match-cn annotation.